Try to decode the userinfo response like a JWT

lib/Service/OIDCService.php

@@ -11,6 +11,7 @@
 
 use OCA\UserOIDC\Db\Provider;
 use OCA\UserOIDC\Helper\HttpClientHelper;
+use OCA\UserOIDC\Vendor\Firebase\JWT\JWT;
 use OCP\Security\ICrypto;
 use Psr\Log\LoggerInterface;
 use Throwable;
@@ -37,12 +38,31 @@ public function userinfo(Provider $provider, string $accessToken): array {
 				'Authorization' => 'Bearer ' . $accessToken,
 			],
 		];
+
 		try {
-			return json_decode($this->clientService->get($url, [], $options), true);
+			$userInfoResponse = $this->clientService->get($url, [], $options);
 		} catch (Throwable $e) {
 			$this->logger->warning('[UserInfo] Failed to fetch user info endpoint', ['exception' => $e]);
 			return [];
 		}
+
+		try {
+			return json_decode($userInfoResponse, true, 512, JSON_THROW_ON_ERROR);
+		} catch (Throwable) {
+			$this->logger->debug('[UserInfo] The response is not JSON');
+		}
+
+		JWT::$leeway = 60;
+		try {
+			$jwks = $this->discoveryService->obtainJWK($provider, $userInfoResponse);
+			$payload = JWT::decode($userInfoResponse, $jwks);
+			$arrayPayload = json_decode(json_encode($payload), true);
+			$this->logger->debug('[UserInfo] Decoded the JWT response', ['decoded_userinfo_response' => $arrayPayload]);
+			return $arrayPayload;
+		} catch (Throwable $e) {
+			$this->logger->warning('[UserInfo] Failed to decode the response as a JWT', ['exception' => $e]);
+			return [];
+		}
 	}
 
 	public function introspection(Provider $provider, string $accessToken): array {

tests/unit/Service/OIDCServiceTest.php

@@ -0,0 +1,88 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+declare(strict_types=1);
+
+use OCA\UserOIDC\Db\Provider;
+use OCA\UserOIDC\Helper\HttpClientHelper;
+use OCA\UserOIDC\Service\DiscoveryService;
+use OCA\UserOIDC\Service\OIDCService;
+use OCA\UserOIDC\Vendor\Firebase\JWT\JWT;
+use OCA\UserOIDC\Vendor\Firebase\JWT\Key;
+use OCP\Security\ICrypto;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+
+class OIDCServiceTest extends TestCase {
+
+	private DiscoveryService&MockObject $discoveryService;
+	private HttpClientHelper&MockObject $clientHelper;
+	private Provider&MockObject $provider;
+	private OIDCService $oidcService;
+
+	public function setUp(): void {
+		parent::setUp();
+		$this->discoveryService = $this->createMock(DiscoveryService::class);
+		$this->clientHelper = $this->createMock(HttpClientHelper::class);
+		$this->provider = $this->createMock(Provider::class);
+		$this->oidcService = new OIDCService(
+			$this->discoveryService,
+			$this->createMock(LoggerInterface::class),
+			$this->clientHelper,
+			$this->createMock(ICrypto::class),
+		);
+
+		$this->discoveryService->method('obtainDiscovery')
+			->willReturn(['userinfo_endpoint' => 'https://idp.example.org/userinfo']);
+	}
+
+	private static function createRsaKeyPair(): array {
+		$key = openssl_pkey_new(['private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA]);
+		openssl_pkey_export($key, $privateKey);
+		return [$privateKey, openssl_pkey_get_details($key)['key']];
+	}
+
+	public function testUserinfoJsonResponse(): void {
+		$this->clientHelper->method('get')
+			->willReturn(json_encode(['sub' => 'alice', 'email' => 'alice@example.org']));
+		$this->discoveryService->expects($this->never())->method('obtainJWK');
+
+		$this->assertSame(
+			['sub' => 'alice', 'email' => 'alice@example.org'],
+			$this->oidcService->userinfo($this->provider, 'access-token'),
+		);
+	}
+
+	public function testUserinfoSignedJwtResponse(): void {
+		[$privateKey, $publicKey] = self::createRsaKeyPair();
+		$jwt = JWT::encode(['sub' => 'alice', 'email' => 'alice@example.org'], $privateKey, 'RS256', 'key1');
+
+		$this->clientHelper->method('get')->willReturn($jwt);
+		$this->discoveryService->expects($this->once())
+			->method('obtainJWK')
+			->with($this->provider, $jwt)
+			->willReturn(['key1' => new Key($publicKey, 'RS256')]);
+
+		$this->assertSame(
+			['sub' => 'alice', 'email' => 'alice@example.org'],
+			$this->oidcService->userinfo($this->provider, 'access-token'),
+		);
+	}
+
+	public function testUserinfoJwtWithInvalidSignature(): void {
+		[, $publicKey] = self::createRsaKeyPair();
+		[$otherPrivateKey] = self::createRsaKeyPair();
+		$jwt = JWT::encode(['sub' => 'mallory'], $otherPrivateKey, 'RS256', 'key1');
+
+		$this->clientHelper->method('get')->willReturn($jwt);
+		$this->discoveryService->method('obtainJWK')
+			->willReturn(['key1' => new Key($publicKey, 'RS256')]);
+
+		$this->assertSame([], $this->oidcService->userinfo($this->provider, 'access-token'));
+	}
+}